> For the complete documentation index, see [llms.txt](https://docs.gotempest.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.gotempest.app/productivity/using-ai-agents-to-manage-servers.md).

# AI Agents for Server Automation (Codex, Claude Code, OpenCode)

Connect Codex CLI, Claude Code, OpenCode, or any MCP-compatible AI agent to Tempest so it can operate your SSH servers for you — no shell scripts, just plain-English requests.

Tempest can hand a full SSH terminal to any AI coding agent you already use — Claude Code, Codex CLI, OpenCode, and others. Point it at your saved servers, describe what you want in plain English, and the agent opens the connection, runs the commands, reads the screen, and reports back — including driving interactive tools like `htop` or `vim`, not just one-shot commands.

No shell scripts. No Ansible playbook for a one-off task. Just describe what you want.

## Enabling it

This works through Tempest's built-in MCP server, which any of these agents can connect to. Turning it on takes one command or a short config snippet, depending on which agent you use — see [Install Tempest MCP Server in Claude Code, Codex, Cursor & More](/productivity/install-tempest-mcp-server-in-ai-clients.md) for the exact steps for your client.

Once it's connected, confirm it's working by asking the agent:

> List my saved SSH servers.

If it comes back with your saved hosts, you're ready to go.

Your SSH credentials never leave your device — the agent only ever sees server names and terminal output, never passwords or private keys.

## What you can ask it to do

### Check disk usage across all your servers

> List my saved SSH servers, connect to each one, run `df -h`, and give me a table of filesystem usage. Flag any filesystem over 80%.

The agent connects to each host in turn, runs the check, and comes back with a summary table — no need to open a dozen tabs yourself.

### Restart a failing service

> SSH into my web-01 server and restart the nginx service. Show me the journal output after restart and confirm it's running.

It connects, restarts the service, pulls the recent logs, and tells you whether it came back healthy.

### Investigate a full disk

> My db-02 server is reporting a full disk. SSH in and find what's taking up space under /var.

The agent runs the investigation, drills into the largest directories, and proposes what's safe to clean up — without you touching a terminal.

### Drive an interactive tool

> Open htop on my dev server and tell me which process is consuming the most CPU right now.

The agent can open full-screen terminal programs like `htop` or `vim`, read what's actually rendered on screen — process lists, gauges, menus — and summarize it for you in plain language.

### Roll out a change across a group of servers

> Update /etc/sysctl.conf on all my "production" group servers to set net.core.somaxconn=4096, then reload without rebooting.

It works through the group one host at a time, applies the change, and reports back which servers succeeded.

## Tips for writing effective prompts

**Name your servers clearly.** The agent picks hosts by name, so `db-primary-us-east` is easier for it (and you) to reason about than `srv-04`.

**Prefer your saved servers over typing credentials into the chat.** Saved hosts keep your credentials out of the conversation entirely — they're decrypted locally from your vault. If you ask the agent to connect with a password typed inline instead, that password will be visible in the conversation.

**Ask the agent to clean up when it's done.** A closing note like *"disconnect all sessions when finished"* keeps things tidy.

**For long-running commands**, tell the agent to give it time: *"Run the backup script and give it 60 seconds before checking the output."*

## Keeping an eye on what it does

Most agent CLIs show you what the agent is about to run before it executes — Codex CLI's approval policy, Claude Code's confirmation prompt, Cursor's per-action approval. Review those, especially before approving anything destructive (`rm`, `systemctl stop`, `DROP TABLE`, and the like). For the fuller picture on credential handling and connection security, see the [Security notes](/productivity/install-tempest-mcp-server-in-ai-clients.md#security-notes) in the installation guide and [Reset Your Tempest Password](/account-and-privacy/resetting-password.md) for vault key rotation.

## See also

* [Install Tempest MCP Server in Claude Code, Codex, Cursor & More](/productivity/install-tempest-mcp-server-in-ai-clients.md) — how to turn this on for every major AI client
* [Tempest AI Security Model](/productivity/tempest-ai-security-model.md) — how Tempest keeps an agent's access in check
* [Tempest AI Assistant](/productivity/tempest-ai-assistant.md) — built-in chat panel for ad-hoc questions in an open terminal tab
* [SSH Snippets & Scheduled Commands](/productivity/snippets-scheduled-runs.md) — run recurring commands on a schedule without an AI agent
* [Self-Hosted Tempest Server & Web Mode](/deployment/self-hosted-tempest-server.md) — host the MCP server on a remote machine for team use
* [Where Tempest Stores Your Credentials](/account-and-privacy/where-tempest-stores-credentials.md) — vault encryption details